If the abused auth feature is not needed otherwise, you can configure Postfix to not expose that feature to the wider internet. This is usually done by editing your main.cf and master.cf files.
First, read your logs. I think your legitimate mail submissions are distinguishable from internet mail receipt via three methods, so you can limit your service to just that. Verify that:
- They always authenticate,
- they always use specific ports dedicated to mail submission,
- and they always connect via the VPN, not via the internet address.
If that is true, you can easily ensure that authentication is only available to that limited subset of connections:
Step 1: In master.cf, you find the services where you so want authenticated mail submission and only for those turn authentication on.
Typically, you only have one or two such services, easily identifiably from the first column: smtps, possibly additionally submission.
Optionally bind it to the not publicly routed address your clients in VPN see your server at (I used fd00:1337::1:5 in my example), if they should not be accessible from the internet.
# line below is the where you prepend the network address
fd00:1337::1:5:smtps inet n - n - - smtpd
-o example_other=option
-o more_options=example
-o smtpd_sasl_auth_enable=yes
# line above is the option you add. note the leading space
# line below is the where you prepend the network address
fd00:1337::1:5:submission inet n - n - - smtpd
-o example_other=option
-o more_options=example
-o smtpd_sasl_auth_enable=yes
# line above is the option you add. note the leading space
Since this means postfix cannot properly bind the ports if it is started before your VPN setup has setup the internal IPs, this may mean that you need to add a service dependency (could be a one-liner, depends on your system/distribution). You are not done until you have verified that your new configuration works after a reboot.
Step 2: In main.cf, you turn of authentication for all smtpd instances
# it defalts to off
smtpd_sasl_auth_enable = no
Now, except for the specific services for which it is explicitly enabled above, postfix will not announce supporting authentication. Clients that try anyway will be refused service by postfix, leaving your authentication backend unbothered.
